Privacy Policy

Information you provide

• Email address (newsletter subscription, account registration)
• Google account information (name, email, profile picture) via Google OAuth
• Newsletter preferences (language, digest frequency, delivery channel)
• Interest and topic preferences
• Article ratings and feedback
• Unsubscribe reasons (optional)

Information collected automatically

• Pages visited, referrer URL, browser type (user agent)
• Preferred language and locale
• Timezone (for newsletter delivery optimization)
• Timestamps of visits and interactions
• IP address (processed but not stored in identifiable form)

Information we do NOT collect

• No third-party tracking cookies
• No advertising pixels or cross-site trackers
• No financial or payment information collected
• No third-party adtech platforms

We run our own first-party product analytics (via the /api/analytics endpoint on our own domain) that records the page path you view, the referring URL, and your browser type (user agent), so we can understand how the Service is used and improve it. This data is first-party and self-hosted on Google Cloud; it is not shared with any third-party adtech platform and is not used for cross-site tracking. We do not use Plausible or any third-party analytics service.

First-party product analytics (necessary to operate the Service)

To operate, secure and improve the Service, we record basic usage data with our own first-party product analytics (page path, referrer and browser type — see Section 2 above). This is internal operational telemetry: first-party, self-hosted, never shared with a third-party adtech platform, never used for cross-site tracking, and never used to serve advertising. We do not sell this data.

In countries that do not recognise “legitimate interest” as a lawful basis (including China, India, Vietnam, Malaysia and Hong Kong — see Section 13), this product analytics runs only on your consent or on irreversibly de-identified data.

Purposes that require your separate consent

The following purpose is not necessary to deliver the service you asked for, so we will not use your personal data for it unless you give us separate, specific consent that you can withdraw at any time. You may decline or withdraw it without affecting your use of the Service:

• Training and improving our AI and machine-learning models — we tell you plainly when this is the purpose, and we never train on special-category (sensitive) data

Separately, we may create irreversibly de-identified or aggregated data that can no longer be linked to you; such data is no longer personal data and we may use it freely (including for analytics and model training).

European Economic Area (GDPR)

You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. You may withdraw consent at any time.

California Residents (CCPA/CPRA)

You have the right to know what personal information we collect, request deletion, opt out of the sale of personal information (we do not sell your data), and not be discriminated against for exercising your rights.

Taiwan Residents (PDPA)

Under the Personal Data Protection Act (個人資料保護法), you have the right to request access, copies, supplementation, correction, cessation of collection/processing/use, and deletion of your personal data.

Taiwan & Hong Kong

Your data is processed in Google Cloud's Taiwan region (asia-east1) by default and is not transferred to mainland China, Hong Kong, or Macau. We comply with Taiwan's Personal Data Protection Act (and Hong Kong's PDPO where it applies), including its notice, consent, and breach-reporting duties.

European Union / EEA & United Kingdom

We comply with the GDPR and UK GDPR. Taiwan is not an EU-adequate country: personal data of people in the EU/EEA and UK is kept in European regions, and international transfers use the European Commission's standard contractual clauses (or the UK IDTA) with a transfer-risk assessment (Schrems II). We will name our EU Article 27 representative on request, and the newsletter is opt-in under the ePrivacy Directive. You may lodge a complaint with your national supervisory authority and have the right not to be subject to solely-automated decisions that significantly affect you.

California & the United States

We give the notice required by the CCPA/CPRA. We do not sell your personal information or share it for cross-context behavioural advertising; we honour the Global Privacy Control browser signal and any “Do Not Sell or Share” request.

China, India, Vietnam, Malaysia & Hong Kong (no legitimate interest)

In these countries we do not rely on “legitimate interest” as a basis for processing. First-party product analytics and AI / model-training reuse therefore run ONLY on your explicit, named-purpose consent or on irreversibly de-identified data. In India, we give a standalone, itemised notice and support a registered Consent Manager where the law requires it.

Indonesia, Vietnam & Thailand

We provide this policy in the local language (Bahasa Indonesia, Tiếng Việt, Thai) where the law requires it, and put the required cross-border-transfer mechanism in place before processing your data — including Vietnam's filed transfer-impact assessment (TIA) and Indonesia's Electronic System Operator (PSE) registration acknowledgement under UU PDP. In these countries we do not rely on legitimate interest for analytics or AI / model training; those run only on your consent or on irreversibly de-identified data.

Nigeria, Kenya & South Africa

We comply with the Nigeria Data Protection Act (NDPA), Kenya's Data Protection Act and South Africa's POPIA respectively, name the relevant regulator (Nigeria's NDPC, Kenya's ODPC, South Africa's Information Regulator), register where the law requires it, and use the approved cross-border-transfer mechanism (in Nigeria including the NDPC's cross-border data-transfer — CBDTI — approval).